add ca certificates to the OCI image

Without this, checking the authority of TLS certificates fails, making
Conduit (rightly) refuse to connect to anything.

flake.nix

@@ -167,6 +167,9 @@
         pkgs.dockerTools.buildImage {
           name = package.pname;
           tag = "next";
+          copyToRoot = [
+            pkgs.dockerTools.caCertificates
+          ];
           config = {
             # Use the `tini` init system so that signals (e.g. ctrl+c/SIGINT)
             # are handled as expected